ZDI-26-267: Malwarebytes Anti-Malware Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Anti-Malware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8.
AI Analysis
Technical Summary
The vulnerability in Malwarebytes Anti-Malware is a local privilege escalation caused by an uncontrolled search path element within the Malwarebytes service. This flaw allows an attacker who already has low-privileged code execution on the target system to escalate privileges to SYSTEM by exploiting the service's loading of a file from an unsecured location. The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was publicly disclosed on April 15, 2026. It is fixed in version 1.0.6.31 of the product.
Potential Impact
Successful exploitation allows local attackers to escalate privileges from low-privileged user context to SYSTEM level, enabling full control over the affected system. This includes the ability to execute arbitrary code with the highest privileges, compromising confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported at the time of disclosure.
Mitigation Recommendations
Apply the official fix by upgrading Malwarebytes Anti-Malware to version 1.0.6.31 or later. This update addresses the uncontrolled search path element vulnerability. Until the update is applied, restrict local code execution privileges to trusted users only to reduce risk.
ZDI-26-267: Malwarebytes Anti-Malware Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Description
This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Anti-Malware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Malwarebytes Anti-Malware is a local privilege escalation caused by an uncontrolled search path element within the Malwarebytes service. This flaw allows an attacker who already has low-privileged code execution on the target system to escalate privileges to SYSTEM by exploiting the service's loading of a file from an unsecured location. The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was publicly disclosed on April 15, 2026. It is fixed in version 1.0.6.31 of the product.
Potential Impact
Successful exploitation allows local attackers to escalate privileges from low-privileged user context to SYSTEM level, enabling full control over the affected system. This includes the ability to execute arbitrary code with the highest privileges, compromising confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported at the time of disclosure.
Mitigation Recommendations
Apply the official fix by upgrading Malwarebytes Anti-Malware to version 1.0.6.31 or later. This update addresses the uncontrolled search path element vulnerability. Until the update is applied, restrict local code execution privileges to trusted users only to reduce risk.
Technical Details
- Article Source
- {"url":"http://www.zerodayinitiative.com/advisories/ZDI-26-267/","fetched":true,"fetchedAt":"2026-05-26T19:58:45.867Z","wordCount":183}
Threat ID: 6a15fc93e29bf47b5055e0c7
Added to database: 05/26/2026, 20:03:31 UTC
Last enriched: 05/26/2026, 20:10:00 UTC
Last updated: 07/29/2026, 08:19:50 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.